Hacker News Reader

How can it be that Facebook with all their engineering prowess can't even tell who accessed what, let alone put adequate permission controls on their APIs? Didn't they invent GraphQL and whatnot and aren't they bound to GDPR in EU requiring them to list specifically and individually the external partner companies they're sharing data with, and the kind of data shared?

View on HN

Probably laziness. A few years ago (before GDPR) third party "apps" on FB could access many things, and FB just said "don't worry, the devs can't do anything bad because they had to click a button that said they'll follow our rules, or be banned!".

So many of my friends used stupid quiz apps, certainly leaking my data to those 3rd parties too.

>> How can it be that Facebook with all their engineering prowess can't even tell who accessed what, let alone put adequate permission controls on their APIs?

> Probably laziness

Facebook is a lot of things, but they're not lazy. As far as can be seen, their decisions are largely intentional. If they didn't do something, it's because they didn't want to or it would hurt their bottom line, not cause they're lazy.

Reply on news.ycombinator.com